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Cryptographic scheme proposed by Bennett, Brassard, and 
Mermin [Phys. Rev. Lett. 68, 557 (1992)] is reformulated 
in a version involving two polarizing Mach-Zehnder interfer- 
ometers. Such a form, although physically equivalent to the 
original one, makes its security explicit, suggestive and easy 
to explain to non-experts. 

PACS number: 03.65 Bz 



In the Ekert cryptographic scheme (E91) |l| pairs of 
EPR particles were used to generate identical sequences 
of bits in remote places, while Bell's theorem certified 
that the particles were not measured in transit by an 
eavesdropper. The modification of the Ekert scheme pro- 
posed by Bennett, Brassard and Mermin (BBM92) ||] 
did not use the Bell theorem and was based essentially 
on the fact that two particles correlated by a singlet state 
behave similarly to a single particle. A user of the crypto- 
graphic channel, traditionally called Alice or Bob, instead 
of sending a polarized particle through the channel, may 
make a measurement of polarization of his or her particle 
and somehow "create" an appropriately polarized object 
at the other side of the channel. In this way the BBM92 
protocol becomes a kind of the original Bennett-Brassard 
1984 (BB84) protocol || but with "polarization at a dis- 
tance" 0. 

Quantum cryptography based on entangled states is 
an ingenious practical application of the set of ideas and 
techniques that were originally developed in order to un- 
derstand the problem of completeness and limitations of 
quantum mechanics. Another such application, equally 
amazing and simultaneously very simple, is the idea of 
interaction-free measuerements proposed by Elitzur and 
Vaidman (EV) || . Below I will discuss the latter in some 
detail since the objective of this Letter is to show that 
combining the ideas of BBM92 and EV one arrives at 
a particularly suggestive version of a quantum crypto- 
graphic scheme. The scheme can be formally shown to 
be secure by a direct application of the proof given in 
BBM92. What is interesting, however, its security is 
so explicit that an explanation of the problem to non- 
experts becomes particularly simple. As opposed to the 
standard schemes one can illustrate the point without 
referring to technical aspects such as complementarity, 
non-cloning theorem, or Bell's theorem with all its loop- 
holes. 

Let us begin with the EV experiment. It is based on 
the Mach-Zehnder interferometer consisting of two iden- 
tical semi-transparent symmetric mirrors (Fig. 1). The 



action of such mirrors can be described by 2 x 2 unitary 
maps 
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Using a matrix notation one can write U as a 2 x 2 unitary 
matrix, say, 
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An essential ingredient of the interferometer is the 7r/2 
phase shift occuring between the transmitted beams: For 
0i in = 1, V>2in = (i.e. \ip) in = |l) in ) one finds 



U\l) ia =^=(i\l 
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The fact that the two mirrors are identical implies that 
the twice-transmitted beam is shifted by ir with respect 
to the beam which is twice-reflected. And vice versa: 
The beam that has been reflected at the first mirror and 
then transmitted at the second one, has the same phase 
as the beam that has been first transmitted and then re- 
flected. An interference between the upper and the lower 
paths results finally in a completely destructive interfer- 
ence in the "Tout" port and a completely constructive 
interference in the "2-out" port. Formally this looks as 
follows 



U 2 \l) in = i\2) c 



(4) 



or U 2 — ia x . Now, without going into formal details, it is 
clear that had we closed one of the paths in the interfer- 
ometer, the interference pattern would be destroyed and, 
independently of the choice of |i/')in, the output probabil- 
ities would be 1/2. In this way a detection in the "1-out" 
port of a single photon may signal a presence of an ob- 
stacle in one of the paths even though there is no transfer 
of energy to the obstacle. This is the essence of the EV 
interaction-free measurement. 

The cryptographic scheme I will describe below is 
based on a similar property of a polarizing Mach-Zehnder 
interferometer (Fig. la). A detailed theory of such a de- 
vice was presented in j(| and the configuration of the 
cryptographic channel was inspired by the beautiful in- 
terferometric version of the EPR problem proposed by 
Zukowski and Pykacz 0. 

The interferometer we will concentrate on is called po- 
larizing because the first semi-transparent mirror is re- 
placed by an analyzer of circular polarizations (denoted 
U±): A right-handed beam incoming through the "1-in" 
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port is reflected and goes "up", whereas a left-handed 

beam goes through the device unchanged. To get a close jj ± 

analogy with the EV problem we assume that the phase 

shifts between the two beams that leave the analyzer are 

identical to those generated by U [compare (H)]: 

t/±(A|l + )i„ + B|l-)in) = iA\l + ) ont +B\2_) ont . (5) U W 



It is clear that a recombination of the two beams will 
not lead to any interference between the two paths of 
the interferometer because the two beams have different 
circular polarizations. Therefore before we recombine the 
two beams at a semi-transparent mirror, we first turn 
the left-handed beam into a right-handed one by means 
of a half-wave plate which is placed at the lower path of 
the interferometer. Such an interferometer can be used 
to make an interaction-free measurement if one takes a 
linearly polarized state (polarization along an x-axis) 
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as the input. Indeed, as we shall see in a moment, the 
entire interferometer maps jl^m into i|2+) ou t- Analo- 
gously, a y-polarized state 



|l 1/ ) in = -^(|l_) ia -|l + ) i 



(7) 



is transformed into |l+) ut (note that all these states are 
right-handed). The one-to-one relationship between the 
linear polarization states of the input and the appropri- 
ate "out" ports will be lost if some obstacle will close 
one path of the interferometer: An obstacle at the lower 
path removes a left-handed component from the incom- 
ing beam; an obstacle at the upper path removes a right- 
handed component. The effect of the obstacle is therefore 
equivalent to putting a circular polarization filter at the 
input of the interferometer. I point out this element to 
show that the one-to-one relationship we have just men- 
tioned is physically equivalent to the EV effect. However, 
this is not what we are interested in here. What is impor- 
tant, the "EV effect" turns our polarizing interferometer 
into an analyzer of linear polarizations, a property of cru- 
cial importance for the cryptographic procedure. 

Before we proceed further let us first make our discus- 
sion more formal. The Hilbert space of the input is now 
4-dimensional (two output ports and two polarization 
states in each port makes four "out" states; by unitarity 
we must have also four "in" states). It is instructive to 
consider an interferometer with an arbitrary phase shift 
a. A state will be written in the circular polarisation 
basis: 



The four parts of the interferometer are 
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(polarizing beam splitter) (9) 



(half wave plate) 



(phase shifter) 
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(symmetric mirror) (12) 



and the entire interferometer is 



v a = UU a U x/2 U ± 
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The fact that V a is an analyzer of linear polarizations 
can be seen in the formulas 
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Of special importance for us are the folmulas ( fbi] ) and 
( |l6| ) since they explicitly show the linear polarization ba- 
sis analyzed by V a . We shall rewrite these formulas as a 
definition of the new basis: 



«|2 + )out = V^|a)i n 
-|l+)out = V a \aj_)i, 



(18) 
(19) 
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In particular, |0) in = |l x )in and \0±_) in = 
us recall that the interferometer acts as the analyzer of 
linear polarizations as a result of the interference between 
the two circular polarizations: For any linearly polarized 
input state its different circular components propagate 
by different paths and interfere due to the presence of 
the half- wave plate. 

Consider now a source producing either of the following 
two entangled states (Fig. 2). 



|*£> = ^(|l+>in|l->in±|l-> 
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where the circular polarization states correspond to pho- 
tons propagating to the "left" and to the "right" , respec- 
tively. Switching to the linear polarization basis we find 
that 

\K) = -/|(|a)i»in - K)inK}in) (21) 

\*ta) = 7/J(W>i»in - |a)in|c*J.)in) (22) 

and, since the formula is valid for any a, we obtain two 
EPR-type states with entangled linear polarizations (par- 
allel for l^^) and perpendicular for l^;"))- On the other 
hand, both states have maximally entangled circular po- 
larizations. The entanglement of linear polarizations to- 
gether with the analyzcr-of-lincar polarizations property 
of V a explain the origin of violation of the Bell inequality 
in a coincidence experiment with the state V a ® V^l 1 ^). 
To give an example, one finds 

(*£|v2 ® v^|p(i + ) out ® P(i + ) out \v a ® v^+) 

= (*M ® ^|P(2+)out ® P(2+) out \V a ® V>|*£) 

2 a — /3 
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(23) 



where the P's are projectors corresponding to the outputs 
of the two interferometers. In particular, for a = (3 one 
obtains the perfect coincidence of detections. It is easy 
to understand this effect when we recall that for |^[^) the 
linear polarizations of both photons are the same inde- 
pendently of the choice of the polarization plane and that 
the phase of the interferometer determines the plane of 
polarization analyzed by the interferometer. However, in 
a realistic experiment the result of the form (^3|) will hold 
approximately since for either a or (3 nonzero the above 
formulas are valid for purely monochromatic fields. An 
efficiency will be maximal only for a = /3 = 0. The above 
arrangement is therefore naturally suited for the EPR- 
type cryptography discussed by Bennett in where the 
polarizations involved are linear-x, linear-?/, left-handed 
and right-handed. 

Assume Alice and Bob choose interferometers with no 
phase shifts (i.e. with equal lengths of the paths, simi- 
larly to the EV experiment, Fig. lb) and a source pro- 
ducing 



l*i f n> = ^(|l.>in|l,)i„-|l,>in|l,>in 



(24) 
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(|l + ) in |l_) in + |l_) in |l + ) in ) (25) 



and consider the four experiments symbolically denoted 
by 



Vo®V 
Vo ® U± 
U± ® Vo 
U±(g>U± 



(26) 
(27) 
(28) 
(29) 



In (PC| ) Alice and Bob both measure linear polarizations; 
in ( p7| ) Alice measures a linear polarization but Bob mea- 
sures a circular one, and so on. Each of them chooses 
between Vb and U± at random. The cryptographic key is 
produced, for example, when they both measure circular 
polarizations [i.e. (|29|)1 but the test for eavesdropping is 
performed by comparison of data collected in ( p6f ) and a 
part of those from (29). 

It is easy to show that the scheme is secure. Indeed, 
Eve in order to get an information about the key has to 
measure circular polarizations. After a measurement she 
sends to Alice and Bob appropriately polarized photons, 
say, |l_) in |l + ) in . But Alice and Bob test for eavesdrop- 
ping by measuring linear polarizations. The perfect cor- 
relations in the Vb ® Vb experiment are due to the "EV 
effect" , that is are present if and only if each of the pho- 
tons goes by both paths in the interferometer. However, 
whenever Eve sends photons that are circularly polar- 
ized, the photons propagate by only one path in the in- 
terferometers (a similar effect would be obtained if Eve 
had closed the upper path in Alice's interferometer and 
the lower path in Bob's one). The reason is obvious: 
A right-handed photon is with certainty reflected by U± 
and goes by the upper path, and the left-handed one 
is with certainty transmitted by U± and goes through 
the lower path. There is absolutely no way of sending 
a photon that with certainty would go by only one path 
and simultaneously by both paths. However, a part of 
data for measurements of circular polarizations must be 
also checked for coincidence to avoid the following rather 
nasty attack. Eve measures circular polarizations for all 
pairs, but then sends to Alice and Bob identical linear 
polarized photons. They check for eavesdropping and do 
not discover anything. Alice encodes the secret informa- 
tion according to the one-time pad procedure, but when 
it turns out that Bob cannot decode the information it 
is already too late since Eve knows the message. When 
they sacrifice a part of the possible key data they very 
quickly discover there is no perfect correlation in circular 
polarizations. 

To formally prove the security one simply repeats the 
steps from BBM92 and substitutes circular polarizations 
for measurements of a z and the linear ones for those of 
<J X - 

The procedure I propose is equivalent to BBM92, E91, 
and BB84. However, I believe it is much more intuitive 
and easier to explain to those who are not profession- 
ally involved in investigation of foundations of quantum 
mechanics. It clearly shows the analyzer-of-linear polar- 
izations property of the polarizing Mach-Zehndcr inter- 
ferometer. The latter feature is very paradoxical in itself 
and can be used to prove a simple Bell-type theorem for 
a single photon ||. 
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FIG. 1. (a) Polarizing Mach-Zehnder interferometer. U± is 
an analyzer of circular polarizations, U a symmetric lossless 
beam splitter, A/2 a half-wave plate, and (3 a phase shifter. 
The upper paths are labelled "1" and the lower ones "2". U± 
is fully transparent for left-handed photons and fully reflect- 
ing for the right-handed ones if they arrive through the "1-in" 
port. The properties of the analyzer with respect to the pho- 
tons arriving through the "2-in" port are irrelevant from the 
viewpoint of our discussion, (b) Ordinary Mach-Zehnder in- 
terferometer used in the Elitzur- Vaidman experiment. The 
beam of light arriving through the "1-in" port leaves through 
the "2-out" port. 

FIG. 2. An experiment V a ®Vp. Alice (left) and Bob (right) 
measure linear polarizations of photons arriving in a singlet 
state. The polarization planes are determined by the phases 
of the interferometers. The experiment U± <g> U± corresponds 
to the situation where instead if recombining the beams at U 
the detectors are placed directly behind U±. 
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Fig. la 



Fig.lb 



